{"repo":"NousResearch/hermes-agent","public_id":"77471","display_label":"Webhook and API key secrets config.yaml exposure","summary":"These items address a security concern where webhook secrets and model API keys are being stored in plaintext inside config.yaml instead of being kept exclusively in environment variables or secure references. The work involves identifying the violation and changing how secrets are stored or referenced.","subsystem":"gateway","counts":{"members":3,"open_issues":1,"open_issues_distinct":1,"open_prs":1,"closed_issues":0,"merged_prs":0,"attempt_prs":2},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[],"members":[{"kind":"issue","number":77471,"title":"fix(security): WEBHOOK_SECRET and model API keys land in plaintext config.yaml, violating the .env-only-secrets rule","url":null,"state":"open"},{"kind":"pr","number":78086,"title":"fix(security): keep webhook and model API keys out of config.yaml","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":85025,"title":"fix(security): store webhook secrets by reference and migrate plaintext","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"5b501333fc75e5e9bf72ae4bda2116fee832ac9e","number":0},{"kind":"commit","value":"e60983a69730c058ce772829df3273aee6de3889","number":0}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}